Virus and Spyware Removal Guides, uninstall instructions

What kind of malware is IRATA?

IRATA is the name of an Android-specific malware. This program has spyware and stealer capabilities. It was discovered after a smishing (SMS phishing) attack in Iran. This campaign entailed legitimate-looking SMSes containing a link to a fake governmental website. The page urged visitors to download an app and pay a fee for the service.

It is noteworthy that IRATA has the ability to create a botnet from infected devices and use it to self-proliferate via spam text messages.

What kind of application is Shop and Watch?

During an examination of the Shop and Watch browser extension, we discovered that it displays annoying advertisements. Thus, Shop and Watch can be classified as adware. Also, Shop and Watch adds the "Managed by your organization" feature to Chrome browsers and can read various data. Users should not trust this application and remove it from the affected browsers.

What is AnkylosaurusMagniventris?

While analyzing an untrustworthy installer obtained from an unreliable website, we came across the AnkylosaurusMagniventris browser extension. The investigation revealed troubling attributes linked to this extension, including its capacity to enable the "Managed by your organization" setting in the Chrome browser, collect user data, and manipulate browser components.

What kind of malware is LostTrust?

LostTrust is the name of a ransomware variant discovered by us while examining malware samples submitted to VirusTotal. The purpose of LostTrust is to encrypt data to make it inaccessible to victims. Also, LostTrust appends the ".losttrustencoded" extension to filenames and delivers a ransom note ("!LostTrustEncoded.txt").

An example of how LostTrust modifies filenames: it changes "1.jpg" to "1.jpg.losttrustencoded", "2.png" to "2.png.losttrustencoded", and so forth.

What kind of software is NXD Fix?

While investigating deceptive sites, we discovered an installer containing the NXD Fix browser extension. This piece of software is classified as a browser hijacker.

However, NXD Fix does not operate as a standard hijacker, i.e., it does not modify browser settings and does not routinely redirect to fake search engines. NXD Fix does promote nxdfix.com under specific circumstances.

What kind of page is notif-next[.]com?

Upon examining notif-next[.]com, it has been discovered that the main purpose of this site is to trick unsuspecting visitors into allowing it to send them notifications. Additionally, notif-next[.]com may redirect visitors to other (potentially harmful) websites. For these reasons, users should not visit notif-next[.]com.

What kind of application is News Directory?

After assessing the News Directory application, it has been established that its primary function is to operate as a browser hijacker with the aim of promoting a legitimate search engine. This extension hijacks a web browser by changing its settings. Users often add browser hijackers without knowing they will affect their browsers this way.

What kind of software is ChatGPT Check?

Our research team discovered the ChatGPT Check browser extension while investigating untrustworthy websites. We found a page pushing an installation setup containing this extension and ChatGPT Check's "official" promotional page.

The latter described it as a tool for those who do not want to create an account or pay for ChatGPT, as this browser extension does not require signing up and allows three daily searches using the AI (Artificial Intelligence) chatbot free of charge. However, after analyzing this piece of software, we determined that it is a browser hijacker promoting the chatcheckext.com fake search engine.

It must be emphasized that this rogue extension is in no way associated with either the actual ChatGPT or its developer – OpenAI.

What kind of malware is Apocalipse?

Apocalipse is a malicious program based on Chaos ransomware. Our researchers discovered it while investigating new submissions to the VirusTotal platform. Malware within the ransomware classification is designed to encrypt data and demand payment for its decryption.

On our test machine, Apocalipse encrypted files and appended their filenames with an extension composed of four random characters. For example, a file initially titled "1.jpg" appeared as "1.jpg.2qdp", "2.png" as "2.png.cc5n", etc. Afterward, a ransom note – "read_it.txt" – was created.

What kind of software is Virtual Piano New Tab?

Virtual Piano New Tab is a rogue browser extension. It is promoted as a virtual piano widget for browsers. After analyzing this piece of software, we determined that it is a browser hijacker. This extension makes changes to browser settings in order to endorse (via redirects) the find.vnav-web.com fake search engine.